Read the docs
TI-2025-30252 Aliases CVE-2025-47787

Emlog Pro Contains a File Upload Vulnerability

Priority HIGH 80CWE-434Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-434.

Summary

Emlog is an open source website building system. Emlog Pro prior to version 2.5.10 contains a file upload vulnerability. The store.php component contains a critical security flaw where it fails to properly validate the contents of remotely downloaded ZIP plugin files. This insufficient validation allows attackers to execute arbitrary code on the vulnerable system. Version 2.5.10 contains a patch for the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00766 55th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed emlog (emlog): 2.5.10

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
emlogemlogbefore 2.5.102.5.10Patch availableCNA
  • emlog Vendoremlog Affected before 2.5.10 Fixed in 2.5.10 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:emlog:emlog:*:*:*:*:pro:*:*:*before 2.5.10Vulnerableemlog
  • cpe:2.3:a:emlog:emlog:*:*:*:*:pro:*:*:* Versions before 2.5.10 Vulnerable ·emlog

Remediation

  • Fix · CNA emlog (emlog) Fixed in 2.5.10

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-47787

References

Exploit 1

Patch 1

  • TI-2025-21066 An arbitrary file upload vulnerability in the component /views/plugin.php of emlog pro… CVSS 3.1CRITICAL 9.8
  • TI-2025-19139 An arbitrary file upload vulnerability in the component admin\plugin.php of Emlog Pro… CVSS 3.1CRITICAL 9.8
  • TI-2023-24041 An arbitrary file upload vulnerability in the component /admin/plugin.php of Emlog Pro… CVSS 3.1CRITICAL 9.8
  • TI-2023-23173 Deserialization of Untrusted Data in emlog pro v.2.1.15 and earlier allows a remote… CVSS 3.1CRITICAL 9.8
  • TI-2026-18317 emlog Arbitrary File Upload Vulnerability CVSS 4.0CRITICAL 9.3
  • TI-2025-30250 EMLOG SQL Injection Vulnerability CVSS 3.1HIGH 8.8
See all 92 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences